CVE-2017-6562: XSS
Published Mar 9, 2017
·Updated
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=[XSS] attack.
Affected Software
1 affected component
Agora-Project Agora-Project=3.2.2
Event History
Mar 9, 2017
CVE Published
via MITRE·09:26 AM
Data Sourced
via MITRE·09:26 AM
Description
Data Sourced
via NVD·09:59 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
An attacker needs to cause a user to interact with a crafted request containing malicious script in the targetObjIdChild parameter. The CVSS vector indicates no attacker privileges are required, but user interaction is required.
2
What impact can successful exploitation have?
The CVSS assessment indicates low confidentiality and integrity impact, with no availability impact. Because the scope is changed, the script may affect a security authority beyond the vulnerable component's own scope.